Privacy Policy

Last Updated: July 31, 2026

This Privacy Policy explains what BeforeOuch collects, why, who we share it with, and how long we keep it.

1. Information We Collect

1.1 Account Information

• Email address, required to create an account
• Name and profile image, if you sign in with Google
• Sign-in method: BeforeOuch has no passwords. You sign in with your Google account or with a one-time code sent to your email address. One-time codes are stored only as a hash, expire quickly, and are deleted once used.

1.2 Images and Content

We process the images you upload, the prompts and references you provide, and basic file information such as size, format, and upload time.

Your uploaded images are deleted automatically: after 1 day on a free account, after 30 days on a paid account. We do not use your images to train AI models, or for any purpose other than providing the service you asked for.

1.3 Usage Data

• Technical information: IP address, browser, device, and operating system
• Usage records: which features you used, when, and whether they succeeded
• Analytics: page views, session duration, and navigation paths

1.4 Payment Information

Payments are handled by Stripe. We never receive or store your card number. We keep your subscription status, remaining credits, and expiry dates.

1.5 Cookies and Tracking Technologies

We honour the Global Privacy Control (Sec-GPC: 1) and legacy Do Not Track (DNT: 1) signals. Either one stops our attribution cookie, our anonymous visit record, and third-party analytics scripts. It does not stop the logs required to run your account, keep it secure, and bill it correctly. You can also opt out of Google Analytics here. We do not currently provide a cookie banner.

2. How We Use Your Information

• To provide the Service: process your images, deliver AI output, and manage your account and subscription
• To improve the Service: analyze usage patterns, monitor performance, and fix problems
• To communicate with you: sign-in codes, billing notices, and support replies
• For security and legal compliance: prevent fraud and abuse, enforce our Terms, and meet legal obligations

3. How We Share Your Information

3.1 We Do Not Sell Your Data

We will never sell your personal information or your images.

3.2 Service Providers

We use these providers under agreements that require them to protect your data and use it only to provide their service to us.

3.3 Legal Requirements

We may disclose information in response to valid legal requests, to protect our rights or the safety of users, to prevent fraud, or in connection with a merger or acquisition.

4. Your Images

4.1 We Do Not Train on Your Images

We do not use your uploaded images to train AI models. We do not build datasets from them, and we do not share or sell them to AI research organizations. Our AI providers are contractually prohibited from training on your images or using them for their own purposes.

Body photos you upload for Tattoo Try-On are processed only on our own infrastructure and are never sent to a third-party AI provider. Prompts and reference images you provide to the AI Tattoo Generator are sent to the AI providers listed in section 3.2.

We may record non-image statistics, such as how many people used a feature, for product decisions.

4.2 Deletion

• Automatic: after 1 day on a free account, after 30 days on a paid account
• Manual: delete any image from your history at any time, or delete all of them at once from account settings — both take effect immediately
• Account closure: deleting your account removes every image stored with it, immediately

4.3 Security

All data is encrypted in transit (TLS) and at rest (AES-256). Images are stored under randomly generated file names and are never listed, indexed, or searchable, and your history is visible only to you. Anyone holding a direct link to one of your images can open it until that image is deleted, so treat those links as private. Administrative access to storage is limited to essential maintenance.

5. Your Privacy Rights

5.1 What You Can Do Yourself

From account settings, at any time:

• Export your data — download a machine-readable copy of everything we hold
• Delete your images — individually or all at once
• Delete your account — removes your account and everything linked to it

5.2 GDPR Rights (EEA, UK, Switzerland)

You have the right to access, correct, delete, port, and restrict processing of your personal data, to object to processing, and to withdraw consent. You also have the right to lodge a complaint with your local data protection supervisory authority.

5.3 CCPA Rights (California)

You have the right to know what personal information we collect, to access and delete it, and not to be discriminated against for exercising those rights. We do not sell or share personal information as defined by the CCPA.

5.4 How to Exercise Your Rights

Most requests are faster to handle yourself using the controls in section 5.1. Otherwise, email support@beforeouch.com with the subject “Privacy Rights Request”, from the address on your account.

We may ask for additional proof of identity before acting on a request. We respond within 30 days, or within 60 days for complex requests, with notice of the extension.

6. Data Retention

Closing your account deletes it along with everything linked to it, ahead of any of the windows above. Aggregated, non-identifying data may be retained indefinitely.

7. Children’s Privacy

BeforeOuch is not directed to children under 13, and we do not knowingly collect personal information from them, as required by the Children’s Online Privacy Protection Act (COPPA). Users aged 13–17 may use BeforeOuch only with verifiable parental or guardian consent.

If you are a parent or guardian and believe your child has provided us with personal information, email support@beforeouch.com with the subject “Child Privacy Concern” and we will delete the account and its data.

8. International Data Transfers

BeforeOuch operates globally, and your data may be processed outside your country of residence, including in the United States and Singapore. Where our processors offer them, we rely on Standard Contractual Clauses approved by the European Commission and on Data Processing Agreements. Several of our processors are self-certified under the EU–US Data Privacy Framework; BeforeOuch itself is not certified under the Framework.

9. Security

We use encryption in transit and at rest, limit access to user data, and maintain incident response procedures. No system is completely secure. If we detect a breach affecting your personal information, we will notify you within 72 hours as required by law.

10. Changes to This Policy

We may update this Policy. Minor changes are posted here with a new “Last Updated” date. For material changes affecting your rights, we will email you at least 30 days in advance and post a notice in the Service. Changes take effect immediately for new users, and 30 days after notification for existing users.

11. Contact Us

Email: support@beforeouch.com Website: https://www.beforeouch.com

---

Summary

• ✅ Your images belong to you — we never claim ownership
• ✅ No AI training on your images — your content is private
• ✅ Automatic deletion — 1 day free, 30 days paid
• ✅ We don’t sell your data — not now, not ever
• ✅ You’re in control — export or delete everything yourself, any time
• ✅ GDPR & CCPA rights supported — access, deletion, and portability